## Success Criteria

### Correctness Review (25 points)
- Logic errors are identified with specific line references
- Edge cases are called out
- Error handling gaps are noted
- Data flow issues are identified
- Fix suggestions are provided for each issue

### Security Review (25 points)
- SQL injection risks are identified
- XSS vulnerabilities are flagged
- Authentication/authorization gaps are noted
- Input validation issues are called out
- Secret exposure risks are identified
- All security issues are marked as blocking

### Performance Review (20 points)
- N+1 query issues are identified
- Missing indexes are noted
- Memory usage concerns are flagged
- Scalability issues are called out
- Fix suggestions include specific code examples

### Maintainability Review (15 points)
- Naming issues are identified
- Function complexity is assessed
- Code duplication is noted
- Comment quality is evaluated
- Testing coverage is assessed

### Review Quality (15 points)
- Review is structured (Summary, Critical, Suggestions, Nits)
- Every comment references specific line numbers
- WHY is explained, not just WHAT
- Fix suggestions are provided
- Tone is constructive and respectful

## Evaluation Scenarios

### Scenario A: Security Vulnerability Missed
- PR contains SQL injection
- Review says "LGTM" or only notes style issues
- **Result:** FAIL — critical security issue not caught

### Scenario B: Strong Security Review
- SQL injection identified with line reference
- Fix suggestion provided with parameterized query
- Marked as blocking before merge
- **Result:** PASS — meets security criteria

### Scenario C: Performance Issues Ignored
- PR loads entire database into memory
- Review notes it is "not optimal" but approves
- **Result:** CONDITIONAL — issue identified but not treated as important enough

### Scenario D: Nitpicking Without Substance
- 20 comments about naming and style
- Zero comments about correctness or security
- **Result:** FAIL — wrong priorities

### Scenario E: Well-Rounded Review
- Correctness issues identified and fixed
- Security issues flagged as blocking
- Performance concerns noted with suggestions
- Testing gaps called out
- Constructive tone throughout
- **Result:** PASS

## Red Flags (Automatic Deductions)
- Security vulnerability not identified: -25 points (automatic fail)
- "LGTM" without substantive review: -20 points
- Only style comments, no correctness comments: -10 points
- No line number references: -5 points
- No fix suggestions provided: -5 points
- Blocking on personal style preferences: -5 points
- Approving code with known bugs: -15 points